Bugzilla User-Matching Information Disclosure Vulnerability
BID:14996
Info
Bugzilla User-Matching Information Disclosure Vulnerability
| Bugtraq ID: | 14996 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 01 2005 12:00AM |
| Updated: | Oct 01 2005 12:00AM |
| Credit: | Reported by <[email protected]>. |
| Vulnerable: |
Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 |
| Not Vulnerable: |
Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 |
Discussion
Bugzilla User-Matching Information Disclosure Vulnerability
Bugzilla is prone to an information disclosure vulnerability when user-matching is turned on. This could allow an attacker to enumerate usernames on the system.
Bugzilla 2.19.1 to 2.20rc2 and 2.21 are prone to this vulnerability.
Bugzilla is prone to an information disclosure vulnerability when user-matching is turned on. This could allow an attacker to enumerate usernames on the system.
Bugzilla 2.19.1 to 2.20rc2 and 2.21 are prone to this vulnerability.
Exploit / POC
Bugzilla User-Matching Information Disclosure Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Bugzilla User-Matching Information Disclosure Vulnerability
Solution:
This issue has been addressed in Bugzilla 2.20 and 2.21.1.
Mozilla Bugzilla 2.19.1
Mozilla Bugzilla 2.19.2
Mozilla Bugzilla 2.19.3
Mozilla Bugzilla 2.20 rc1
Mozilla Bugzilla 2.20 rc2
Mozilla Bugzilla 2.21
Solution:
This issue has been addressed in Bugzilla 2.20 and 2.21.1.
Mozilla Bugzilla 2.19.1
-
Mozilla bugzilla-2.20.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.20.tar.gz
Mozilla Bugzilla 2.19.2
-
Mozilla bugzilla-2.20.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.20.tar.gz
Mozilla Bugzilla 2.19.3
-
Mozilla bugzilla-2.20.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.20.tar.gz
Mozilla Bugzilla 2.20 rc1
-
Mozilla bugzilla-2.20.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.20.tar.gz
Mozilla Bugzilla 2.20 rc2
-
Mozilla bugzilla-2.20.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.20.tar.gz
Mozilla Bugzilla 2.21
-
Mozilla bugzilla-2.21.1.tar.gz
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.21.1.tar.gz
References
Bugzilla User-Matching Information Disclosure Vulnerability
References:
References: